Using Azure Media Services to deliver DRM licenses with shaka packager?

Question

I am building a subscription based Video On Demand service. For content protection I choose Widevine & Azure Media Services for License delivery which costs US$0.20 for 100 licenses. Shaka Packager for media packaging.

I followed this guide & got :

Created key nb:kid:UUID:d2c69XXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX with key value XXXXXXXXXXXXXXXXf7Kc7g==
PlayReady License Key delivery URL: https://xxxxxxx.keydelivery.centralindia.media.azure.net/PlayReady/
Widevine License Key delivery URL: https://xxxxxxx.keydelivery.centralindia.media.azure.net/Widevine/?KID=d2c69XXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
Added authorization policy: nb:ckpid:UUID:5274f7da-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Shaka Packager Documentation

$ packager <stream_descriptor> ... \
  --enable_widevine_encryption \
  --key_server_url <key_server_url> \
  --content_id <content_id> \
  --signer <signer> --aes_signing_key <aes_signing_key> \
  --aes_signing_iv <aes_signing_iv> \
  [Other options, e.g. DASH options, HLS options]

So I have key_server_url , content_id

where do I find aes_signing_key & aes_signing_iv ?

Similar question (unanswered) here: https://stackoverflow.com/questions/36018756/encryption-settings-for-widevine-cenc-on-azure-media-services — Brian Harris, Mar 05 '20 at 22:03
Identical question here: https://social.msdn.microsoft.com/Forums/en-US/91047d92-baa4-43c8-90c7-531c07069a65/drm-licenses-with-shaka-packager?forum=MediaServices — Brian Harris, Mar 07 '20 at 02:56
Identical question was posted by me & they have answered me with test credentials from documentation; what do I do with that :( — Garvit Jain, Mar 07 '20 at 05:25
Just asked over here: https://github.com/MicrosoftDocs/azure-docs/issues/49780 — Brian Harris, Mar 09 '20 at 16:20
Also asked about it here: https://github.com/google/shaka-packager/issues/727 — Brian Harris, Mar 09 '20 at 16:28

score 2 · Answer 1 · answered Mar 13 '20 at 22:33

The link to the documentation and the example you have provided is for when you are using a Widevine Key Server, with the information returned from the API linked to on that page, the 'Common Encryption API for Widevine DRM'.

Note the link to that document may not work without permission but you can usually see a version as an example if you google for the title of the API.

In your case you probably want to use the instructions for 'Using Raw Key' in the Shaka documentation here: https://google.github.io/shaka-packager/html/tutorials/raw_key.html#using-raw-key

This includes examples like:

$ packager \
  in=h264_baseline_360p_600.mp4,stream=audio,output=audio.mp4,drm_label=AUDIO \
  in=h264_baseline_360p_600.mp4,stream=video,output=h264_360p.mp4,drm_label=SD \
  in=h264_main_480p_1000.mp4,stream=video,output=h264_480p.mp4,drm_label=SD \
  in=h264_main_720p_3000.mp4,stream=video,output=h264_720p.mp4,drm_label=HD \
  in=h264_high_1080p_6000.mp4,stream=video,output=h264_1080p.mp4,drm_label=HD \
  --enable_raw_key_encryption \
  --keys label=AUDIO:key_id=f3c5e0361e6654b28f8049c778b23946:key=a4631a153a443df9eed0593043db7519,label=SD:key_id=abba271e8bcf552bbd2e86a434a9a5d9:key=69eaa802a6763af979e8d1940fb88392,label=HD:key_id=6d76f25cb17f5e16b8eaef6bbf582d8e:key=cb541084c99731aef4fff74500c12ead \
  --mpd_output h264.mpd

For 'key_Id' you use the returned key UUID and for 'key=' the returned 'key value'.

Although it is not required as an input here, just to note for completeness, the Initialization Vector, 'aes_signing_iv' in the Widevine API, is typically not a secret value. It is simply a 'seed' value that is used to start the block initialisation for AES encryption. It can be created and passed to the packager, and is often simply a random 8 or 16 byte IV for each piece of content.

@GarvitJain - you can use the info in the response you showed above, yes. — Mick, Mar 15 '20 at 13:02
Nice this worked for me! had to remove the dashes from the key id when passing it to shaka packager. And I had to convert azure's key value from base64 to hex when passing to shaka packager. Also had to pass this flag, --protection_systems Widevine,PlayReady — Brian Harris, Mar 15 '20 at 19:29
@GarvitJain - for Widevine the license URL is not passed in the manifest or the media - it has to be configured on the player or the client. — Mick, Mar 16 '20 at 10:30

Using Azure Media Services to deliver DRM licenses with shaka packager?

1 Answers1